How to build an Exchange Hybrid Environment (CheckList)


I have been working this last year on number of Migration using third party tools or Hybrid deployment.

So please find a way to Design & deploy a working Exchange Hybrid Environment.

Requirements & Preparation

Active Directory
Forest & Domain Functional Level:

  • Windows 2008 DC to be able to use writeback (AD Connect)
  • Windows 2012R2 Forest level: Workplace Join (AD FS)
Schema Update:

  • Some Exchange CU required Schema Update
User authentication method:

  • UserPrincipalName (UPN):
  • SAMAccountName:
    • contoso\user
Domain suffix will be used for SSO
The Domain must be registered as a public domain with Public DNS

  • Yes: advise to use UPN
  • No: Add a new Domain Suffix or consider to use AlternateID
UPN must be know set and known by the user

  • UPN is match user email address (Recommendation)
Run Microsoft Office 365 Deployment Readiness Tool (user Impact)
Run IdFix to validate Users Readiness for Office 365 migration
Supported Exchange & Client:

  • Exchange Version:
  • Client Connectivity: Outlook\OWA\EAS\OA (version & enable)
Required Exchange Servers for Hybrid:

  • % of available resources (Exchange Calculator)
  • Additional server is needed
Namespace publicly available: EWS, OWA, Autodiscover, OA, EAS
(Check using Microsoft Remote Connectivity Analyzer)
Accepted Domains
Availability Space or Federation Trust (Free\Busy Sharing)
Autodiscover is pointing to your on-premise Exchange organization

  • Publish External
  • MRS Proxy is enabled
Valid Certificate from Third Party Provider (Exchange Web Services)
Self-Signed certificate for Federation Trust with MFG (only)
EWS External URL specified in your public DNS listed in the SAN
Autodiscover Endpoint specified in your public DNS listed in the SAN
All Exchange Server used for mail transport in Hybrid Deployment must use the same certificate (same CA & same Subject)

  • Hybrid Server to Exchange Online
  • Hybrid Server to EOP (Mail Flow)
Office 365
Sign up for Office 365
Valid Global Admins from your office 365 Tenant
Validation of custom Domain

  • Every accepted domain need to be set as office 365 custom domain
  • UPN suffix need to set as custom domain
  • Validation using TXT Record
  • Transfer DNS Management if no customization is needed
Directory Synchronization
AD Connect
AD Connect: On-Premise AD – Enterprise Admin
AD Connect: On-Premise Service Account for Federation Service
AD Connect: SQL requirements (Local or Existing SQL Server\Instance)
AD Connect : Firewalls

  • AD Connect -> DCs
  • AD Connect -> ADFS & WAP
  • AD Connect -> Azure AD
Method
ADFS (SSO): Request Servers according the design
ADFS (SSO): Request SQL Instance or WID
ADFS (SSO): A record for Federation Service (Internal DNS)
ADFS (SSO): DNS Entry for Federation Service (Public DNS)
ADFS (SSO): On-Premise Service Account for Federation Service
ADFS (SSO): Pfx certificate with federation service name
ADFS (SSO): Local administrator account for WAP Server(s)
ADFS (SSO): Enable Remote Management for WAP Server
ADFS (SSO): Firewalls

  • ADFS Servers DCs
  • WAP ADFS Server
  • WAP Internet users
Identity Management
AD Connect
How many AD Object to sync to office 365?
Synchronization using OU, Group or Domain
User Principal Name:
Select an Attribute (Default Value : UserPrincipalName (UPN)
This Attribute match the User Primary SMTP address
SourceAnchor selection (ObjectGUID Default)
Features needed:

  • Exchange Hybrid
  • Password Synchronization
  • Password writeback
  • Group Writeback (Office 365 Group)
method
Password Synchronization
Federated with ADFS
How many farm do we need?
How many server do we need ? More than 5?
Federation Service
Enable HA
Using SQL Server
Do we need SQL or WID will be enough
Do we need SQL for AD Connect
Do we need SQL for Federation Servers
Hybrid Environment
Certificate Design

  • Mail Transport (secure communication)
  • Autodiscover, OWA, EAS, OA
Web Services:

  • External FQDN of your Hybrid Server
    • Can be the external LB FQDN to reach your servers
    • Can be OWA external FQDN
Client Connectivity (OWA and EAS)
Availability Space or Federation Trust
Federated & Accepted Domain
Mail flow (Centralized mail Transport)
Federation Trust and Organization Relationships
Hybrid Installation & Configuration
AD Connect
AD Connect Installation & Configuration
Use AD Connect to install ADFS Farm (ADFS Server & WAP)
Configure Hybrid Configuration using HCW:

  • Exchange org Admin (On-Premise)
  • Global Admin (office 365)
  • Federation trust validation (TXT Record)
  • Secure Transport Mail Flow
    • Receive Connector
    • Send Connector
    • Certificate for Secure Mail Transport
    • External FQDN of Hybrid Server for EOP
Validation (checks)
AD Connect
Directory Synchronization:

  • Search for SMTP matching if license already assign
Sign in using SSO (Redirect, ADFS authentication)
Free\Busy Sharing:

  • Office 365 users to On-premise users
  • On-premise users to Office 365 Users
Cross-Premise Features:

  • MailTips
  • Message Tracing
  • Multi-mailbox Search
Online Archiving
OWA redirect\ Exchange ActiveSync Redirect
Cross-Premise Mailbox Permission (Conditions applied)
Unified GAL
Migration (Onboarding)

Operation & Migration (Onboarding)

How to create an User\Mailbox using EAC from on-premise Exchange
Migration Procedure:

  • Using Powershell Script (Sync, Licenses, Complete)
  • Using third Party application
Objects to Migrate:

  • Distribution list
  • Contacts
  • User Mailbox
  • Resource Mailbox
  • Shared Mailbox


Known issues Cross-Premise Mailbox Permission

  • Send as
  • Send on behalf
  • Full Access:
    • Already create (will be migrated)
    • Add full permission
Cross-premise Free\Busy

Comment & question are welcome so please do not hesitate.



How to link you another on-premise user to Azure AD object using immutableID(Hard Match)


Now, with office 365 in Hybrid Mode we need to be able to addresse old scenario like:

User1 left the company and User2 need to be reconnected to user1 Office 365 User (onedrive,Mailbox,sharepoint,…)

User1 has been deleted and you want to reconnect a new User(User2) to the Office 365 User

User1 has been moved from domain1 to Domain2, for administrative reason a new User (User2) has been created in Domain2.

In order to address these scenarios but also the need to disconnect an office 365 user to on-premise user and reconnect another on-premise user in a Hybrid Environment,  we can use the following procedure called Hard Match:

Some additionnal information, in this list of scenario we are making the following assumptions:

  1. User1 and User2 are in the Same AD Forest, this is important because that s means the User will have two diferent ObjectGUID
  2. AD Connect version is matter now because the Hard Match may not work with every version of AD Connect.  Please check  AD Connect Fixes & Improvements
  3. AD Connect is used as Directory synchronization between On-premise AD and Azure AD (Ofice 365)
  4. AD Connect is using the ObjectGUID as SourceAnchor (ImmutableID)
  5.  the environment is running Exchange 2013 RU11

Now, please find the step by step to disconnect and reconnect an user to Office 365 using Hard Match:

  1.  Information regarding User and environment:
    • User1 will be Source\User1
      • User1 UPN:
      • Source User1 has a Remote Mailbox (Office 365 Mailbox)
    • User2 will be Destination\User2
      • is not sync to Cloud
  2. Update Source\User1 Attributes:
    • Mail
    • TargetAddress
    • UPN: in this Procedure User2 will use the User1 UPN because PrimaryEmail Address has to match will the UPN. FYI we can only have one as UPN in this forest. so the UPN will have to be changed. So we will change to so this UPN can be assign to Destination\User2.
    • ProxyAddresses: Save the ProxyAddresses Attribute then clear.
  3. Disable Source\User1 Remote Mailbox
  4. remove Source\User1 from AD Connect Sync Scope
    • Update Attribute use by AD Connect to Sync or No Sync a user to office 365
    • Wait for a Delta sync Cycle to be completed
  5. Disable Source User
  6. Restore MSOL User (Source\ )
    • Restore MSOL User(
    • Set Restored MSOL User ( with immutableID to Null
    • Calculate Destination User (Destination\User2) ImmutableID
    • Set ImmutableID of MSOL User ( to ImmutableID of Destination User (Destination\User2)
    • Change MSOL User UPN to
    • Delete MSOL User (
  7. Update Destination\User2 Attributes
    • Update Destination User2 to match Source\User1 Attributes
    • Update Destination\User2 UPN to ( Please be sure to wait for AD Replication to occur, or it will failed if it found a user with same UPN in the forest)
    • Enable Destination User
  8. Add Destination\User2 to AD Connect Sync Scope
    • Update Attribute use by AD Connect to Sync or No Sync a user to office 365
  9. Enable Remote mailbox for Destination\User2
    • Enable Remote Mailbox for Destination\User2
    • Reattach the Archive mailbox to Office 365 mailbox (if previously attach to Source\User1)
    • Assign the ProxyAddress previously set for Source\User1
    • Update TargetAddress
  10. When complete wait for AD Connect Sync Cycle ( I will recommand to run at least 2 cycle, some time the hard Match is not working at the first Sync)

Important Information, while using this procedure you need to be aware between step 3 and Step 10, the mailbox is disabled so NDR will be receive if you try to send a mail to Office 365 mailbox. so the downtine will be :

  1.  1 AD Connect Sync Cycle for Step 3 to wait for:
    • Wait for Delta Sync, Default setting: 30 min
    • Wait for Delta Sync Cycle to completed (running time): Less than 30 min
  2. 2 AD Connect Sync Cycle for Step 10 to wait for

So with the default configuration of AD Connect, the Maximum downtine if you are not able to start a Delta Sync will be  3 hours.


This Article will be updated with Powershell CMDLets.


Relation between ObjectGUID, SourceAnchor & ImmutableID in Office 365 Hybrid Environment


I have provided you  with a script how to convert the ObjectGUID of AD User to ImmutableID, but I have forgot to explain you the relation between them.

In Hybrid environment with  AD Connect using to sync On-Premise user to Azure AD, with AD Connect set with the default setting:


  1. AD Connect will calculate the source Anchor based on ObjectGUID
  2. AD Connect will also sync the User principal Name using the UserPrincipalName Attribute of the user

Please find the step AD Connect will use to Convert ObjectGUID to ImmutableID:

  1. AD Connect will retreive the User ObjectGUID Attribute through AD Connector
  2. AD Connect will then convert the ObjectGUID to CloudSourceAnchor(in the Metaverse)
  3. AD Connect will then export CloudSourceAnchor(Metaverse) to SourceAnchor(AAD Connector)
  4. The AAD Connector will export SourceAnchor to Azure AD
  5. The SourceAnchor will be saved as ImmutableID Attribute of Azure AD Object.


I hope this information will help to better understand how your AD Connect is working.


How to deploy 2013 Hybrid Server in Exchange 2010 environment.

While working on Deploying 2013 Hybrid Server in an Exchange 2010 environment,  I have faced some issues, so please find a Implementation plan which will help you avoid making my mistakes. so you will have a list of the milestones you shoudn’t missed to successfully deploy an Hybrid Servers




How to Migrate from Exchange 2013 Hybrid Server (Onboarding using Migration Batch)

This script has been create to Migrate user from Exchange environment using Exchange 2013 Server as Hybrid Server. These 2 Script has been create to migrate user to the cloud using Migration Batch. These script will use a Users.csv file as input to create the Migration Batch. This CSV file need only the PrimarySMTPAddress of the user you want to migration to Office 365. every other information will be retreived, like the user UPN.

information need to be updated on this script will be:

  • Office 365 Global Admin UserName
  • Notification email Address to receive an email when the migration batch is completed
  • UsageLocation
  • Hybrid Server name (FQDN)
  • License SKU (using Get-MsolAccountSku)
  • Your target Domain (your

Sync v2.0.ps1

when you successfully run this script, you can the following script to complete the migration batch. if not complete the mailflow will be switch to office 365 and Migration batch will keep update the mailbox between both Organization (Office 365 & On-premise)


Some Walk Through Guide while troubleshooting office 365 issues

This last few months, I have faced serveral issues on my office 365 tenant but as well on my client tenant, please find some Microsoft Guide will help you troubleshoot some known issues:

How to connect to Office 365(Exchange Online) using Windows Powershell

     1.  Software Requirements

Install the 64-bit version of the Microsoft Online Services Sign-in Assistant: Link

Install the 64-bit version of the Windows Azure AD Module for Windows PowerShell: Link

2.  Retreive the credential from a user with sufficient permission (Global admin for example)

# Update the
credential with the appropriate UPN (UserName)

$credential = Get-Credential

3.  Import Office 365 Module

# Import the Office
365 module

Import-Module MsOnline

4.  Connect to office 365

# Connect to office
365 using the Credential previous provided


5.  Create and import Exchange PS  ssession

# Create a PS
Session to Exchange Online

-ConfigurationName Microsoft.Exchange -ConnectionUri “” -Credential $Credential -Authentication “basic” -AllowRedirection

# Import the PS
Session Previously (allowing use of previous PS session with same Name)

 Import-PSSession $ExchangeModule -DisableNameChecking


Please find how to use this script:

 Please find a copy of the script:Connect_to_O365.ps1

Option 1: Launch the script while need to
connect to office 365

Before please be sure the requirements are set (
Softwares and Execution policy)


Option 2: you can update your Powershell Profile with a function


1.  Create a function


Function Connect-ExchangeOnline {

# Update the credential with the appropriate UPN (UserName)

$credential = Get-Credential -credential

# Import the Office 365 module

Import-Module MsOnline

# Connect to office 365 using the Credential previous provided

Connect-MsolService -Credential $credential

# Create a PS Session to Exchange Online

$ExchangeModule = New-PSSession -ConfigurationName Microsoft.Exchange`

-ConnectionUri -Credential $Credential `

-Authentication “basic” -AllowRedirection

# Import the PS Session Previously

# (allowing use of previous PS session with same Name)

Import-PSSession $ExchangeModule -DisableNameChecking -AllowClobber


2.  Open your Powershell Profile

a.  Open windows Powershell

b.  Type $Profile this will give the location of your
powershell profile:


3.  open the Microsoft.Powershell_Profile.ps1 with any
text editor ( in this case Notepad)


d.  Copy the function and save the change


3.  Re-open Windows Powershell then type the function
name Connect-ExchangeOnline


Provide your Office 365 Tenant Admin Credential and now you are
connect to Exchange Online using Windows Powershell.



Continue reading “How to connect to Office 365(Exchange Online) using Windows Powershell”